The DIAG_IOCSREG, DIAG_IOCSDEL and DIAG_IOCSUNREG ioctl numbers are
defined with pointer types, so their size field is 4 for 32-bit
userspace and 8 for 64-bit userspace. user_events_data has no
compat_ioctl handler, so on a 64-bit kernel every one of these ioctls
from a 32-bit task fails with -ENOTTY and such a task cannot register
any user events.
struct user_reg and struct user_unreg are packed and only use fixed-size
fields, so they have the same layout for 32-bit and 64-bit tasks. Add a
compat_ioctl handler that maps the 32-bit ioctl numbers to the native
ones and passes the argument through compat_ptr().
Fixes: 7f5a08c79df3 ("user_events: Add minimal support for trace_event into
ftrace")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Danish Khateeb <[email protected]>
---
Notes:
Tested on x86_64 in QEMU (v7.3-rc5 plus this series, KASAN and lockdep):
- A 32-bit program that registers and unregisters an event gets -ENOTTY
from DIAG_IOCSREG before and works after.
- tools/testing/selftests/user_events built with -m32 (with 2/2): all
four tests fail before and pass after, in three runs each. The
64-bit build passes before and after. No splats.
Also built with CONFIG_COMPAT=n on x86_64 and with CONFIG_COMPAT=y on
riscv64, both with W=1.
kernel/trace/trace_events_user.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
index f658c3a77aa7..07cfbb5a17de 100644
--- a/kernel/trace/trace_events_user.c
+++ b/kernel/trace/trace_events_user.c
@@ -8,6 +8,7 @@
#include <linux/bitmap.h>
#include <linux/cdev.h>
+#include <linux/compat.h>
#include <linux/hashtable.h>
#include <linux/list.h>
#include <linux/io.h>
@@ -2737,6 +2738,36 @@ static long user_events_ioctl(struct file *file,
unsigned int cmd,
return ret;
}
+#ifdef CONFIG_COMPAT
+/*
+ * These IOCTLs encode the size of a pointer and thus change their numbers
+ * between 32 and 64 bits. The structs they point to have the same layout.
+ */
+#define DIAG_IOCSREG_COMPAT _IOWR(DIAG_IOC_MAGIC, 0, compat_uptr_t)
+#define DIAG_IOCSDEL_COMPAT _IOW(DIAG_IOC_MAGIC, 1, compat_uptr_t)
+#define DIAG_IOCSUNREG_COMPAT _IOW(DIAG_IOC_MAGIC, 2, compat_uptr_t)
+
+static long user_events_compat_ioctl(struct file *file, unsigned int cmd,
+ unsigned long uarg)
+{
+ switch (cmd) {
+ case DIAG_IOCSREG_COMPAT:
+ cmd = DIAG_IOCSREG;
+ break;
+ case DIAG_IOCSDEL_COMPAT:
+ cmd = DIAG_IOCSDEL;
+ break;
+ case DIAG_IOCSUNREG_COMPAT:
+ cmd = DIAG_IOCSUNREG;
+ break;
+ }
+
+ return user_events_ioctl(file, cmd, (unsigned long)compat_ptr(uarg));
+}
+#else
+#define user_events_compat_ioctl NULL
+#endif
+
/*
* Handles the final close of the file from user mode.
*/
@@ -2787,6 +2818,7 @@ static const struct file_operations user_data_fops = {
.write = user_events_write,
.write_iter = user_events_write_iter,
.unlocked_ioctl = user_events_ioctl,
+ .compat_ioctl = user_events_compat_ioctl,
.release = user_events_release,
};
base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
--
2.55.0
